Skip to main content
added 165 characters in body
Source Link
$ source <(cat <(printf '%dc() { printf "You\\047ve been hitted: printfyour "You\\047vepasswd beenfile hitted\\041\\n"hold %%d lines\\041\\n" \  $(wc -l </etc/passwd)  };\n' {0..100};printf 'alias %s=1c\n' {0..100};)) 
$ 65;1;9c You've been hitted: your passwd file hold 74 lines! You've been hitted: your passwd file hold 74 lines! You've been hitted: your passwd file hold 74 lines! $ █ 
$ source <(printf '%dc() { printf "You\\047ve been hitted\\041\\n" };\n' {0..100};printf 'alias %s=1c\n' {0..100};) 
$ 65;1;9c You've been hitted! You've been hitted! You've been hitted! $ █ 
$ source <(cat <(printf '%dc() { printf "You\\047ve been hitted: your passwd file hold %%d lines\\041\\n" \  $(wc -l </etc/passwd)  };\n' {0..100};printf 'alias %s=1c\n' {0..100};)) 
$ 65;1;9c You've been hitted: your passwd file hold 74 lines! You've been hitted: your passwd file hold 74 lines! You've been hitted: your passwd file hold 74 lines! $ █ 
added 94 characters in body
Source Link

or in one line

$ . <(printf 'rawless() { %s < <(%s -e "$@");}\n' $(which less cat)) 

or in one line

$ . <(printf 'rawless() { %s < <(%s -e "$@");}\n' $(which less cat)) 
added 176 characters in body
Source Link

Yes.

Definitively yes.

$ cat -e suspectfile.raw $ cat -e suspectfile.raw | less 
$ less < <(cat -e suspectfile.raw) 
$ which less cat /usr/bin/less /bin/cat $ rawless() { /usr/bin/less < <(/bin/cat -e "$@");} 

AddendumRemarks

In fact, it was possible, in past... As this became an issue, these kinds of features was quickly removed, but...

When you read command not found, this implies that something was effectively injected.

$ cat <<< $'\033Z' 

andOr another ANSI sequence: CSI c (Device Attributes):

$ cat <<< $'\033[c' 

will print an empty line, but on next line prompted, you will see 1;2c (or maybe with another numbers, depending on terminal used) as if you hitted them.:

$ 65;1;9c█ 

... andbut with -e switch:

$ cat -e <<< $'\033Z' ^[Z$ $ cat -e <<< $'\033[c' ^[[c$ 
$ cat <<<$'\033Z';buf='';while<<<$'\033[c';buf='';while read -t .1 -n 1 chr;do   buf+="$chr";done;printf buf+="$chr"  done;printf "\n>|%q|<\n" $buf ^[[?1;2c65;1;9c >|$'\E[?1;2c'|<65;1;9c'|< 
$ trySeq() { printf -v out "$1" echo -n "$out" buf="" while read -t.1 -n1 char do buf+="$char" done [ "$buf" ] && printf "\r|%q|->|%q|<\e[K\n" "$out" "$buf" } 
$ for seq in $'\e['{c,{1..26}{n,t,x}};do  trySeq "$seq";done |$'\E[c'|->|$'\E[?65;1;9c'|< |$'\E[1x'|->|$'\E[3;1;1;120;120;1;0x'|< |$'\E[5n'|->|$'\E[0n'|< ... 

(maybe Maybe with some effectharmless effects on your console ;)

Sample for funSmall practical sample

 $ source <(printf '%dc() {  printf "You\\047ve been hitted\\041\\n";hitted\\041\\n" };\n' {0..100};printf 'alias %s=1c\n' {0..100};) 

From thereThen, if you

 $ cat <<<$'\e[c'  $ 65;1;9c_65;1;9c█ 

Cursor will stay at end of command prompt line. 

From there, if you machinally hit Return instead of Ctrl+c, you will read something like:

 $ 65;1;9c bash: 65: commandYou've notbeen foundhitted! bash: 1: commandYou've notbeen foundhitted! You've been hitted!  $ _ 

Yes.

cat -e suspectfile.raw cat -e suspectfile.raw | less 
less < <(cat -e suspectfile.raw) 
which less cat /usr/bin/less /bin/cat rawless() { /usr/bin/less < <(/bin/cat -e "$@");} 

Addendum

In fact, it was possible, in past... As this became an issue, these kinds of features was quickly removed, but...

When you read command not found, this implies that something was effectively injected.

cat <<< $'\033Z' 

and on next line prompted, you will see 1;2c (or maybe with another numbers, depending on terminal used) as if you hitted them.

... and

cat -e <<< $'\033Z' ^[Z$ 
cat <<<$'\033Z';buf='';while read -t .1 -n 1 chr;do buf+="$chr";done;printf "\n>|%q|<\n" $buf ^[[?1;2c >|$'\E[?1;2c'|< 
trySeq() { printf -v out "$1" echo -n "$out" buf="" while read -t.1 -n1 char do buf+="$char" done [ "$buf" ] && printf "\r|%q|->|%q|<\e[K\n" "$out" "$buf" } 
for seq in $'\e['{c,{1..26}{n,t,x}};do trySeq "$seq";done |$'\E[c'|->|$'\E[?65;1;9c'|< |$'\E[1x'|->|$'\E[3;1;1;120;120;1;0x'|< |$'\E[5n'|->|$'\E[0n'|< ... 

(maybe with some effect on your console)

Sample for fun

 $ source <(printf '%dc() { printf "You\\047ve been hitted\\041\\n";};\n' {0..100}) 

From there, if you

 $ cat <<<$'\e[c'  $ 65;1;9c_ 

Cursor will stay at end of command prompt line. From there, if you machinally hit Return instead of Ctrl+c, you will read something like:

 $ 65;1;9c bash: 65: command not found bash: 1: command not found You've been hitted!  $ _ 

Definitively yes.

$ cat -e suspectfile.raw $ cat -e suspectfile.raw | less 
$ less < <(cat -e suspectfile.raw) 
$ which less cat /usr/bin/less /bin/cat $ rawless() { /usr/bin/less < <(/bin/cat -e "$@");} 

Remarks

When you read command not found, this implies that something was effectively injected.

$ cat <<< $'\033Z' 

Or another ANSI sequence: CSI c (Device Attributes):

$ cat <<< $'\033[c' 

will print an empty line, but on next line prompted, you will see 1;2c (or maybe with another numbers, depending on terminal used) as if you hitted them:

$ 65;1;9c█ 

... but with -e switch:

$ cat -e <<< $'\033Z' ^[Z$ $ cat -e <<< $'\033[c' ^[[c$ 
$ cat <<<$'\033[c';buf='';while read -t .1 -n 1 chr;do    buf+="$chr"  done;printf "\n>|%q|<\n" $buf ^[[?65;1;9c >|$'\E[?65;1;9c'|< 
$ trySeq() { printf -v out "$1" echo -n "$out" buf="" while read -t.1 -n1 char do buf+="$char" done [ "$buf" ] && printf "\r|%q|->|%q|<\e[K\n" "$out" "$buf" } 
$ for seq in $'\e['{c,{1..26}{n,t,x}};do  trySeq "$seq";done |$'\E[c'|->|$'\E[?65;1;9c'|< |$'\E[1x'|->|$'\E[3;1;1;120;120;1;0x'|< |$'\E[5n'|->|$'\E[0n'|< ... 

( Maybe with some harmless effects on your console ;)

Small practical sample

$ source <(printf '%dc() {  printf "You\\047ve been hitted\\041\\n" };\n' {0..100};printf 'alias %s=1c\n' {0..100};) 

Then, if you

$ cat <<<$'\e[c' $ 65;1;9c█ 

Cursor will stay at end of command prompt line. 

From there, if you machinally hit Return instead of Ctrl+c, you will read something like:

$ 65;1;9c You've been hitted! You've been hitted! You've been hitted! $  
added 661 characters in body
Source Link
Loading
added 277 characters in body
Source Link
Loading
added 277 characters in body
Source Link
Loading
added 853 characters in body
Source Link
Loading
added 670 characters in body
Source Link
Loading
edited body
Source Link
Loading
added 603 characters in body
Source Link
Loading
added 606 characters in body
Source Link
Loading
added 240 characters in body
Source Link
Loading
added 661 characters in body
Source Link
Loading
Source Link
Loading